fix: harden v2 custom widgets and Workshop (#6480)

apps/nextjs/src/app/api/custom-widgets/[resource]/route.ts

@@ -0,0 +1,42 @@
+import type { NextRequest } from "next/server";
+import { NextResponse } from "next/server";
+
+import { CUSTOM_WIDGET_MCP_AUTHORING_PROMPT } from "@homarr/custom-widgets/authoring-prompt";
+import { getCustomWidgetComponentCatalog, getCustomWidgetSkill } from "@homarr/custom-widgets/authoring-resources";
+import { getCustomWidgetJsonSchema } from "@homarr/custom-widgets/core";
+
+import { adminRoute } from "../admin";
+
+interface RouteContext {
+  params: Promise<{ resource: string }>;
+}
+
+const resources = new Map<string, () => unknown>([
+  ["schema", getCustomWidgetJsonSchema],
+  ["components", getCustomWidgetComponentCatalog],
+  ["skill", getCustomWidgetSkill],
+  [
+    "authoring-prompt",
+    () => ({
+      version: 2,
+      prompt: CUSTOM_WIDGET_MCP_AUTHORING_PROMPT,
+      resources: [
+        "homarr://custom-widgets/schema",
+        "homarr://custom-widgets/components",
+        "homarr://custom-widgets/skill",
+      ],
+      httpResources: ["/api/custom-widgets/schema", "/api/custom-widgets/components", "/api/custom-widgets/skill"],
+    }),
+  ],
+]);
+
+const getAuthoringResource = async (_request: NextRequest, context: RouteContext): Promise<Response> => {
+  const { resource } = await context.params;
+  const loadResource = resources.get(resource);
+  if (!loadResource) {
+    return NextResponse.json({ error: "Custom Widget authoring resource not found." }, { status: 404 });
+  }
+  return NextResponse.json(loadResource());
+};
+
+export const GET = adminRoute(getAuthoringResource);

apps/nextjs/src/app/api/custom-widgets/admin.spec.ts

@@ -0,0 +1,37 @@
+// @vitest-environment node
+
+import { beforeEach, describe, expect, test, vi } from "vitest";
+
+const mocks = vi.hoisted(() => ({
+  auth: vi.fn(),
+}));
+
+vi.mock("@homarr/auth/next", () => ({ auth: mocks.auth }));
+
+import { adminRoute } from "./admin";
+
+beforeEach(() => {
+  mocks.auth.mockResolvedValue({ user: { permissions: ["admin"] } });
+});
+
+describe("Custom Widget HTTP resource access", () => {
+  test("allows authenticated administrators", async () => {
+    const handler = vi.fn(async () => Response.json({ ok: true }));
+    const response = await adminRoute(handler)();
+
+    expect(response.status).toBe(200);
+    expect(handler).toHaveBeenCalledOnce();
+  });
+
+  test.each([
+    ["anonymous users", null],
+    ["authenticated non-admins", { user: { permissions: ["board-modify-all"] } }],
+  ])("denies %s", async (_label, session) => {
+    mocks.auth.mockResolvedValue(session);
+    const handler = vi.fn(async () => Response.json({ ok: true }));
+    const response = await adminRoute(handler)();
+
+    expect(response.status).toBe(403);
+    expect(handler).not.toHaveBeenCalled();
+  });
+});

apps/nextjs/src/app/api/custom-widgets/admin.ts

@@ -0,0 +1,15 @@
+import { NextResponse } from "next/server";
+
+import { auth } from "@homarr/auth/next";
+
+type RouteHandler<Arguments extends unknown[]> = (...args: Arguments) => Response | Promise<Response>;
+
+export const adminRoute =
+  <Arguments extends unknown[]>(handler: RouteHandler<Arguments>) =>
+  async (...args: Arguments): Promise<Response> => {
+    const session = await auth();
+    if (!session?.user.permissions.includes("admin")) {
+      return NextResponse.json({ error: "Administrator access is required." }, { status: 403 });
+    }
+    return handler(...args);
+  };

apps/nextjs/src/app/api/custom-widgets/authoring-prompt/route.ts

@@ -1,18 +0,0 @@
-import { NextResponse } from "next/server";
-
-import { CUSTOM_WIDGET_MCP_AUTHORING_PROMPT } from "@homarr/custom-widgets/authoring-prompt";
-
-export const dynamic = "force-static";
-
-export function GET() {
-  return NextResponse.json({
-    version: 2,
-    prompt: CUSTOM_WIDGET_MCP_AUTHORING_PROMPT,
-    resources: [
-      "homarr://custom-widgets/schema",
-      "homarr://custom-widgets/components",
-      "homarr://custom-widgets/skill",
-    ],
-    httpResources: ["/api/custom-widgets/schema", "/api/custom-widgets/components", "/api/custom-widgets/skill"],
-  });
-}

apps/nextjs/src/app/api/custom-widgets/components/route.ts

@@ -1,9 +0,0 @@
-import { NextResponse } from "next/server";
-
-import { getCustomWidgetComponentCatalog } from "@homarr/custom-widgets/authoring-resources";
-
-export const dynamic = "force-static";
-
-export function GET() {
-  return NextResponse.json(getCustomWidgetComponentCatalog());
-}

apps/nextjs/src/app/api/custom-widgets/configuration-request/[token]/route.ts

@@ -4,25 +4,23 @@ import { NextResponse } from "next/server";
 import {
   claimCustomWidgetConfigurationRequest,
   completeCustomWidgetConfigurationRequest,
+  configureCustomWidgetSourceFromRequest,
   configurePreviewSessionSource,
   getCustomWidgetConfigurationRequest,
-  parseStoredCustomWidgetDefinition,
   releaseCustomWidgetConfigurationRequest,
-  serializeCustomWidgetDefinition,
 } from "@homarr/api/custom-widget-configuration";
-import { encryptSecret } from "@homarr/common/server";
+import { customWidgetSourceSchema } from "@homarr/custom-widgets/core";
 import { invalidateCustomWidgetResponseCache } from "@homarr/custom-widgets/server";
-import { customWidgetSourceSchema, hasSameCustomWidgetSourceAuthentication } from "@homarr/custom-widgets/core";
-import { and, db, eq, handleTransactionsAsync } from "@homarr/db";
-import { customWidgetDefinitions, customWidgetSecrets } from "@homarr/db/schema";
+import { db } from "@homarr/db";
 
+import { adminRoute } from "../../admin";
 import { readConfigurationRequestBody } from "../body";
 
 interface RouteContext {
   params: Promise<{ token: string }>;
 }
 
-export async function GET(_request: NextRequest, context: RouteContext) {
+const getConfigurationRequest = async (_request: NextRequest, context: RouteContext): Promise<Response> => {
   const { token } = await context.params;
   const request = await getCustomWidgetConfigurationRequest(token);
   if (!request)
@@ -38,9 +36,9 @@ export async function GET(_request: NextRequest, context: RouteContext) {
     },
     { headers: { "Cache-Control": "no-store" } },
   );
-}
+};
 
-export async function POST(request: NextRequest, context: RouteContext) {
+const completeConfigurationRequest = async (request: NextRequest, context: RouteContext): Promise<Response> => {
   const { token } = await context.params;
   const pending = await getCustomWidgetConfigurationRequest(token);
   if (!pending || pending.status !== "pending") {
@@ -94,19 +92,24 @@ export async function POST(request: NextRequest, context: RouteContext) {
       );
       invalidateCustomWidgetResponseCache([`custom-jsx:preview:${claimed.target.id}:`]);
     } else {
-      const definition = await db.query.customWidgetDefinitions.findFirst({
-        where: eq(customWidgetDefinitions.id, claimed.target.id),
+      const result = await configureCustomWidgetSourceFromRequest(db, {
+        definitionId: claimed.target.id,
+        sourceId: claimed.sourceId,
+        baseUrl: sourceResult.data.baseUrl,
+        networkScope: sourceResult.data.networkScope,
+        secrets,
+        expectedSource: claimed.source,
       });
-      if (!definition) return NextResponse.json({ error: "The custom widget no longer exists." }, { status: 404 });
-      const parsed = parseStoredCustomWidgetDefinition(definition);
-      const currentSource = parsed.sources[claimed.sourceId];
-      if (!currentSource) {
+      if (result.status === "definition-not-found") {
+        return NextResponse.json({ error: "The custom widget no longer exists." }, { status: 404 });
+      }
+      if (result.status === "source-not-found") {
         return NextResponse.json(
           { error: "This API source changed after the setup link was created. Request a new setup link." },
           { status: 409 },
         );
       }
-      if (!hasSameCustomWidgetSourceAuthentication(currentSource, claimed.source)) {
+      if (result.status === "binding-changed") {
         return NextResponse.json(
           {
             error: "This API source authentication changed after the setup link was created. Request a new setup link.",
@@ -114,69 +117,6 @@ export async function POST(request: NextRequest, context: RouteContext) {
           { status: 409 },
         );
       }
-      const configuredSource = customWidgetSourceSchema.parse({
-        ...currentSource,
-        baseUrl: sourceResult.data.baseUrl,
-        networkScope: sourceResult.data.networkScope,
-      });
-      const definitionChanges = {
-        ...serializeCustomWidgetDefinition({
-          ...parsed,
-          sources: { ...parsed.sources, [claimed.sourceId]: configuredSource },
-        }),
-        updatedAt: new Date(),
-      };
-      const secretRows = secrets.map((secret) => ({
-        definitionId: claimed.target.id,
-        sourceId: secret.sourceId,
-        kind: secret.kind,
-        encryptedValue: encryptSecret(secret.value),
-        updatedAt: new Date(),
-      }));
-      await handleTransactionsAsync(db, {
-        async handleAsync(database, schema) {
-          await database.transaction(async (transaction) => {
-            await transaction
-              .update(schema.customWidgetDefinitions)
-              .set(definitionChanges)
-              .where(eq(schema.customWidgetDefinitions.id, claimed.target.id));
-            for (const secret of secretRows) {
-              await transaction
-                .delete(schema.customWidgetSecrets)
-                .where(
-                  and(
-                    eq(schema.customWidgetSecrets.definitionId, claimed.target.id),
-                    eq(schema.customWidgetSecrets.sourceId, secret.sourceId),
-                    eq(schema.customWidgetSecrets.kind, secret.kind),
-                  ),
-                );
-              await transaction.insert(schema.customWidgetSecrets).values(secret);
-            }
-          });
-        },
-        handleSync(database) {
-          database.transaction((transaction) => {
-            transaction
-              .update(customWidgetDefinitions)
-              .set(definitionChanges)
-              .where(eq(customWidgetDefinitions.id, claimed.target.id))
-              .run();
-            for (const secret of secretRows) {
-              transaction
-                .delete(customWidgetSecrets)
-                .where(
-                  and(
-                    eq(customWidgetSecrets.definitionId, claimed.target.id),
-                    eq(customWidgetSecrets.sourceId, secret.sourceId),
-                    eq(customWidgetSecrets.kind, secret.kind),
-                  ),
-                )
-                .run();
-              transaction.insert(customWidgetSecrets).values(secret).run();
-            }
-          });
-        },
-      });
     }
 
     await completeCustomWidgetConfigurationRequest(token);
@@ -184,4 +124,7 @@ export async function POST(request: NextRequest, context: RouteContext) {
   } finally {
     await releaseCustomWidgetConfigurationRequest(token);
   }
-}
+};
+
+export const GET = adminRoute(getConfigurationRequest);
+export const POST = adminRoute(completeConfigurationRequest);

apps/nextjs/src/app/api/custom-widgets/schema/route.ts

@@ -1,9 +0,0 @@
-import { NextResponse } from "next/server";
-
-import { getCustomWidgetJsonSchema } from "@homarr/custom-widgets/core";
-
-export const dynamic = "force-static";
-
-export function GET() {
-  return NextResponse.json(getCustomWidgetJsonSchema());
-}

apps/nextjs/src/app/api/custom-widgets/skill/route.ts

@@ -1,9 +0,0 @@
-import { NextResponse } from "next/server";
-
-import { getCustomWidgetSkill } from "@homarr/custom-widgets/authoring-resources";
-
-export const dynamic = "force-static";
-
-export function GET() {
-  return NextResponse.json(getCustomWidgetSkill());
-}